Morocco Surveillance Machine Turns Phones Into Listening Devices

On October 1, 2026, Amnesty International published the most detailed account yet of how Moroccan authorities built a surveillance apparatus aimed at silencing journalists and activists. The investigation is built around testimony from a former intelligence officer known only as Safir, corroborated with digital forensics, leaked records, and interviews with ten people who say they were targeted. For anyone who carries a phone everywhere, this Morocco surveillance story lands uncomfortably close to home.

At the center of the picture is Pegasus, the highly invasive spyware made by Israel-based NSO Group. According to Amnesty International, Morocco's domestic intelligence service, the DGST, began deploying the tool in 2017 and had it fully operational within months. Forensic analysis of the earliest targeting records, covering September to December of that year, matched 103 Moroccan phone numbers to specific individuals selected as potential targets. Of those, 65 belonged to civil society figures: 34 human rights defenders, 22 journalists and media workers, five lawyers, and four academics. The Morocco surveillance effort was aimed at critics first, the evidence suggests. "These records show the phone numbers of prominent human rights defenders and journalists were among the first to be entered into the Pegasus system," said Donncha Ó Cearbhaill, head of the organization's Security Lab, according to the statement — indicating, he argued, that silencing critics was the priority purpose for acquiring the system.

The net stretched across borders. The rights group says its technical analysis forensically attributes numerous Pegasus attacks to the DGST, forming an extensive cross-border campaign against journalists, activists, lawyers, and politicians caught in the Morocco surveillance net — and previously unpublished internal NSO Group materials, disclosed in a US court case brought by WhatsApp and Meta, show NSO staff conducted trainings and test demonstrations for the Moroccan customer, which the company internally codenamed Morgen. Targets in Europe included the family of a Sahrawi civil prisoner, whose phone was forensically confirmed as compromised. Four weeks before publishing, Amnesty wrote to Moroccan authorities inviting a response and received none, according to the organization.

Not Just Spyware: Hidden Mics and Pre-Infected Phones

What sets the Morocco surveillance report apart is how far the toolkit went beyond hacking phones. According to Amnesty International, Safir described targets being secretly filmed and audio-recorded in detention, offices, cars, cafes, and even bedrooms. Investigative journalist Omar Radi discovered hidden microphones implanted in his apartment's light fixtures. Agents tracked location data, intercepted calls, and ran remote-control software on computers at internet cafes frequented by targets. Phone shops were co-opted to sell handsets already infected with spyware, and neighbors of targeted defenders were recruited as informants to file daily reports on their movements. Infection methods included one-click links, zero-click attacks that need no action by the victim, and network injection delivered through the state-owned telecom network.

The harvested material then fed a second machine: smear campaigns. Private photos, recordings, and messages were published in media outlets supportive of the authorities, often followed by judicial proceedings, arrests, and trials. Veteran activist Fouad Abdelmoumni was secretly filmed at home with his fiancee in 2021 — footage he believes came from a hidden camera in an air-conditioning unit, based on the recording's angle. The rights group says this pipeline of surveillance, smear, and prosecution operates without judicial oversight, targeting people in secrecy and with impunity. The Morocco surveillance findings describe chilling effects that reach far beyond the targets themselves, into families, friendships, and professional networks.

Morocco has repeatedly denied using spyware against its citizens. Authorities challenged Amnesty to produce material evidence in statements issued in 2020 and 2022. Some Moroccan media have also pushed back on the new report: one outlet argued that a phone number's presence in Pegasus targeting records does not by itself prove a device was infected or establish who ordered an attack. That is a fair evidentiary caveat — but Amnesty's case no longer rests on target lists alone. Between the insider testimony, the forensics, the leaked internal NSO materials, and the victims' accounts, the Morocco surveillance investigation is built on four independent legs, which is precisely what makes it harder to dismiss.

Journalists Who Knew They Were Being Watched

The report details four individual cases. Radi, who was investigating land dispossession in Morocco, spent two years — from 2018 to 2020 — noticing his phone's battery draining fast, the device running hot, and the network slowing down. Amnesty's Security Lab confirmed the compromise in June 2020. The other three are Fouad Abdelmoumni, a veteran activist; Abdessadak El Bouchattaoui, a human rights lawyer whose number was entered into the Pegasus system in September 2017, weeks before he received an infection link by text message; and Hicham Mansouri, a journalist in exile imprisoned in 2015 on charges the rights group describes as trumped-up. The Morocco surveillance report was produced with fourteen media organizations and coordinated by the journalist network Forbidden Stories.

As reported by Al Jazeera, Radi said the findings finally made sense of his experience: "The Amnesty report connected many dots as to what I was living and feeling while I was under tight surveillance." He described physical tailing so open it felt theatrical — agents collecting daily reports from parking attendants on his street and the shops he visited — and said the report explains the extraordinary nature of his police interrogations and trial. Now based in Germany, he remains one of the most visible faces of the Pegasus story in Morocco. The Morocco surveillance dragnet, in his telling, was never about one article; it was about everything around it.

The pattern reaches beyond the report's named cases. Taoufik Bouachrine, one of Morocco's best-known journalists, described a parallel machinery of pressure: fabricated criminal cases, often involving allegations of sexual misconduct that he calls a journalist's moral execution, and smear campaigns run through online trolls targeting journalists and their families. Arrested in 2018 and sentenced to fifteen years, he served more than six before a royal pardon — by which time the newspaper he founded had already died after authorities cut off its advertising revenue. His story did not make the report, but it sketches the ecosystem the Morocco surveillance machine was built to serve.

Why Morocco Surveillance Matters to Anyone With a Phone

This is not really a story about Morocco, in the end. It is a story about what a modern phone is: a microphone, a camera, a location tracker, and an archive of your private life, carried voluntarily in a pocket. Zero-click spyware removes the last fig leaf — the victim never taps anything, never makes a mistake. For young journalists, student activists, creators covering protests, and anyone whose work involves criticizing power, that reality reorders the risk calculus. The chilling effect does not require everyone to be watched; it requires enough people to believe they might be, and for their families and contacts to believe it too. Human rights defenders keep working anyway — but they pay a tax in paranoia that the rest of us never see.

The Morocco surveillance report ends with correspondingly broad demands: end unlawful surveillance, run independent and effective investigations, hold those responsible accountable, and guarantee remedies for victims. The organization also calls on states to suspend exports of spyware and surveillance technology to Morocco until real safeguards exist. The rights group's secretary general said Morocco had embraced what she called techno-authoritarian practices — acquiring a wide range of surveillance technologies specifically to instill fear and obstruct dissent. A recent court ruling that police need a warrant for real-time phone tracking shows the same fight over location privacy is playing out in democracies too, with fewer excuses.

A brief timeline sharpens the picture. In 2017, the DGST began deploying Pegasus, with journalists and defenders as its first priority targets. In 2019, Amnesty published its first forensic confirmations of Moroccan Pegasus infections. In June 2020, Radi's phone was confirmed compromised. In 2021, the Pegasus Project revelations exposed a ten-country targeting map. And on October 1, 2026, the full machine — bugs, bugged phones, informants, smear campaigns — was laid out in one report. The comparison that matters is not between spyware and no spyware. It is between surveillance built to sell ads and surveillance built, as this Morocco surveillance investigation documents, to fabricate charges, stage arrests, and destroy reputations. The phone in your pocket can be either tool. In Morocco, Amnesty says, the state chose the second one.